165 matches found
CVE-2018-13332
CVE-2018-13332 concerns TerraMaster TOS. The connected documents confirm a directory traversal vulnerability in the explorer application of TerraMaster TOS version 3.1.03, which can be exploited to upload files to arbitrary locations via the URL parameter. The CVSS data provided indicates a high...
CVE-2018-13330
TerraMaster TOS 3.1.03 is affected by a system command injection in ajaxdata.php during group creation via the groupname parameter. The vulnerability allows an attacker to execute system commands on the device. Connected advisories (CNVD-2019-00661, NVD CVE-2018-13330, PRION-CVE-2018-13330, OpenV...
CVE-2018-13334
TerraMaster TOS
CVE-2018-13357
CVE-2018-13357 is an XSS in TerraMaster TOS 3.1.03. The vulnerability lies in the Control Panel where JavaScript can be executed when viewing Shared Folders, via the names of Shared Folders. Affected product/component: TerraMaster TOS Control Panel / Shared Folders naming. Impact: attacker can in...
CVE-2018-13354
TerraMaster TOS 3.1.03 is affected by a system command injection in logtable.php exposed via the Event parameter, enabling an attacker to execute arbitrary commands. Multiple sources (NVD, CNVD, OpenVAS, PRION, CVELIST) corroborate that the flaw is reachable remotely (network) with high/critical ...
CVE-2018-13353
TerraMaster TOS 3.1.03 contains a command injection vulnerability in ajaxdata.php via the checkport parameter. The issue allows an attacker to execute arbitrary commands, as indicated by CVE-2018-13353 with high severity (CVSS v3.0 base 8.8). The connected documents confirm the affected endpoint ...
CVE-2018-13418
System command injection in ajaxdata.php in TerraMaster TOS 3.1.03 allows attackers to execute system commands via the "newname" parameter...
CVE-2018-13361
User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "modgroup" parameter...
CVE-2018-13334
Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "optionssysname" parameter...
CVE-2018-13330
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands during group creation via the "groupname" parameter...
CVE-2018-13350
CVE-2018-13350 —TerraMaster TOS 3.1.03 is affected by an SQL injection in the logtable.php file, exploitable via the Event parameter. This vulnerability allows execution of SQL queries and is described in multiple sources, including the NVD entry. The connected documents provide the vulnerable co...
CVE-2018-13329
CVE-2018-13329 concerns TerraMaster TOS (version 3.1.03) where the endpoint ajaxdata.php is vulnerable to cross-site scripting (XSS) via the lines URL parameter. The described impact is that remote attackers can cause JavaScript execution in the context of a user session. The connected documents ...
CVE-2018-13352
Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory...
CVE-2018-13329
Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter...
CVE-2018-13337
Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript...
CVE-2018-13337
Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript...
Cross site scripting
Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "optionssysname" parameter...
Cross site scripting
Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter...